NIST Developing Tailored Cybersecurity Controls for AI Systems

The National Institute of Standards and Technology will soon release the first two volumes of new recommended cybersecurity guidance that would give organizations a starting point for securing AI systems using controls tailored to the technology’s risks.

The Control Overlays for Super Intelligence Systems (COSIS) project, which was recently renamed from Control Overlays for Securing AI Systems to reflect the White House’s preferred term for AI, adapts NIST’s existing SP 800-53 security and privacy controls to AI systems, including predictive, generative and agentic applications. The guidance addresses components such as training data, model weights and configuration settings that traditional IT security controls may not fully account for.

The guidelines come amid growing concerns about the security of AI systems, especially in light of incidents where agentic AI systems broke out of containment and accessed other networks. Although these instances occurred during tests, they present a major threat if used in a deliberate cyberattack.

Additionally, a recent executive order puts much of the burden for monitoring and policing AI/SI systems on the frontier developers themselves. This is driving a need for standards that can provide solid guardrails and guidance for agentic and generative systems for commercial developers and federal agencies using those systems.

Preparing New Standards for AI

When complete, the guidelines will consist of five volumes covering predictive systems, generative systems, agentic systems, a volume for AI software developers and the methodology used by NIST to create the overlays, said NIST Security Engineering and Risk Management Leader Victoria Pillitteri.

Pillitteri’s team plans to release the first two volumes this fall. The first volume provides NIST’s development methodology and the second covers predictive systems. With the speed that AI/SI systems are evolving, she noted that the only constant to expect is constant change and emphasized the importance of making the methodology available to ensure organizations can further customize and update the needed controls.

“In a sense, we are proverbially building the plane as we’re flying it, both from an operational as well as a security perspective,” Pillitteri said.

NIST is building the overlays on established cybersecurity practices rather than creating an entirely new security framework for AI systems.

The project draws on SP 800-53, the Risk Management Framework and other NIST guidance to identify which existing controls apply to AI systems, where they need to be adapted and where additional implementation guidance is necessary, Pillitteri said.

“There’s a lot of advantage to leveraging the body of knowledge that is already here and being used,” Pillitteri said. She added that the method behind developing control overlays is recognizing that federal agencies already use the SP 800-53 standard.

A Starting Point for Implementers, not a Final Checklist

Regardless of technology or application, from a cybersecurity perspective, one outcome — protecting the information and the system is the goal. This applies to control systems, critical infrastructure or an email server, “the principles generally remain the same, what you are protecting and how you implement it will vary,” she said.

In many cases, this same extension applies to AI and SI systems. “What can be built on that is already in place? What needs customization? What needs special consideration or a change of scope? What needs to change in terms of implementation guidance or anything that is unique? That’s the whole premise of using the overlays,” she said.

COSIS complements NIST’s work on the Cyber SI Profile, a NIST-facilitated community profile of the Cybersecurity Framework for AI, Pillitteri said.

For AI overlays, it is key for organizations to understand the scope of a system and what is in and out of scope, Pillitteri said.

In many cases, organizations may not realize there are different considerations for the data being used in AI systems, understand how the underlying models were developed including what security practices were used, and how that AI product or solution is acquired and integrated into their workflows and systems. The overlays help identify the controls managing cybersecurity, privacy risks to specific types of systems, and the applicable phases of the AI system lifecycle that should be considered and implemented.

“Overlays are an 80% solution,” noted Pillitteri. “It will take you part of the way, but you still have to do some work on your end to make it fit in how it works with your [network] perspective.”